Cloudanix VulnDB

CVE-2026-98928

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A setup error in protected virtual machines on ARM processors could cause crashes when certain processor features are enabled.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

Inconsistent SVE flag handling between pkvm_init_features_from_host() and pkvm_vcpu_init_sve() allows a vCPU to be created with a NULL sve_state pointer that the world switch later dereferences while attempting to load guest SVE state, resulting in memory corruption.

Why it matters to the business

Virtualized ARM64 workloads using KVM protected VMs may experience unexpected crashes or instability during context switches when SVE configuration is mishandled, increasing operational risk for cloud and virtualization providers.

How an attack unfolds

An attacker supplies a host configuration that sets KVM_ARCH_FLAG_GUEST_HAS_SVE without the corresponding SVE bit at EL2; during protected vCPU initialization the flag is copied while the bit test fails, producing a vCPU whose NULL sve_state is dereferenced on world switch.

How to fix it

Apply the upstream fix that derives KVM_ARCH_FLAG_GUEST_HAS_SVE directly from the SVE feature bit at EL2 and removes the protected-path copy of the host flag; rebuild and deploy the updated kernel on all affected ARM64 hosts.

How to confirm the fix worked

Confirm the corrected logic in pkvm_init_features_from_host() and pkvm_vcpu_init_sve() no longer allows a NULL sve_state for any vCPU; run KVM unit tests exercising SVE flag combinations on protected VMs.

Typical attack path

  1. Configure host KVM to set GUEST_HAS_SVE flag independently of the EL2 SVE bit
  2. Create a protected VM vCPU that exercises pkvm_vcpu_init_sve()
  3. Trigger a world switch that calls the SVE state load path
  4. Cause NULL pointer dereference or memory corruption

How to detect it

Search kernel logs and KVM tracepoints for null pointer dereferences or warnings involving sve_state during vCPU initialization or world switches on ARM64 hosts.

What your security team should do

  • Prioritize kernel update on all ARM64 KVM hosts within the next maintenance window
  • Review any custom pKVM initialization code that manipulates SVE flags
  • Add monitoring for null-dereference or KVM world-switch panics

The record

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2 pkvm_init_features_from_host() takes KVM_ARCH_FLAG_GUEST_HAS_SVE and KVM_ARM_VCPU_SVE from the host separately, but pkvm_vcpu_init_sve() tests the bit while vcpu_has_sve() reads the flag. A host that sets the flag without the bit gets a vCPU with a NULL sve_state that the world switch loads the guest's SVE state from. Derive the flag from the bit, and drop the protected path's copy of the host's flag, which is dead code since protected VMs are not allowed SVE.

Affected packages

Ecosystem Package Introduced Fixed